# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1893 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1894 --- ## [Best specs for a single cluster?](https://discuss.elastic.co/t/best-specs-for-a-single-cluster/243389)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 5\ **Last updated:** [August 2, 2020, 7:07am UTC](https://discuss.elastic.co/t/best-specs-for-a-single-cluster/243389 "2020-08-02T07:07:08Z")
Bossman wants to deploy a cluster of logstash, elasticsearch and kibana on one machine. He says high availability doesn't matter much since we have a different platform to monitor servers and this would be used to store … --- ## [Snapshot Deletion Takes a very long time](https://discuss.elastic.co/t/snapshot-deletion-takes-a-very-long-time/242222)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 10\ **Last updated:** [August 2, 2020, 6:35am UTC](https://discuss.elastic.co/t/snapshot-deletion-takes-a-very-long-time/242222 "2020-08-02T06:35:05Z")
Hello, We have snapshots for ES 7.5.2 cluster in Google Cloud Storage(GCS). We have a lot of snapshots going almost a year back and now we are trying to delete the snapshots and keep only last 90 days of data. In the pr… --- ## [I want to achieve conditional query in elastic search as described](https://discuss.elastic.co/t/i-want-to-achieve-conditional-query-in-elastic-search-as-described/243431)
**Author:** [@Saumya\_Mishra](https://discuss.elastic.co/u/Saumya_Mishra)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 10:03pm UTC](https://discuss.elastic.co/t/i-want-to-achieve-conditional-query-in-elastic-search-as-described/243431 "2020-08-01T22:03:19Z")
/\* I want to achieve this kind of conditional query in ElasticSearch using PHP client library, I want to execute the match clause(In ElasticSearch) only if the the value is set or if there is some value \*/ $sql="select … --- ## [Unsafe Object Creation Vulnerability in JSON](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434)
**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 8:28pm UTC](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434 "2020-08-01T20:28:02Z")
Hi, There is vulnerability reported on json version used in ruby https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ The ruby version used in latest Logstash contains this json version, which contains… --- ## [From where should i start elastic search, I am beginner for Elastic search?](https://discuss.elastic.co/t/from-where-should-i-start-elastic-search-i-am-beginner-for-elastic-search/243426)
**Author:** [@prabhunath](https://discuss.elastic.co/u/prabhunath)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 6:34pm UTC](https://discuss.elastic.co/t/from-where-should-i-start-elastic-search-i-am-beginner-for-elastic-search/243426 "2020-08-01T18:34:05Z")
From where should I start the elastic search, I am a beginner for Elastic search? Please, anyone, suggest to me. --- ## [Connect to mongodb using logstash Jdbc\_streaming filter plugin](https://discuss.elastic.co/t/connect-to-mongodb-using-logstash-jdbc-streaming-filter-plugin/242082)
**Author:** [@\_Rasitha\_Ariyarathna](https://discuss.elastic.co/u/_Rasitha_Ariyarathna)\ **Replies:** 2\ **Last updated:** [August 1, 2020, 1:47pm UTC](https://discuss.elastic.co/t/connect-to-mongodb-using-logstash-jdbc-streaming-filter-plugin/242082 "2020-08-01T13:47:03Z")
I'm trying to fetch data from mongodb using Jdbc\_streaming filter plugin in logstash in windows. I'm using mongo-java-driver-3.4.2.jar to connect to the database but, getting a error like this JavaSql::SQLException: N… --- ## [Realtime search based on 2 indexes](https://discuss.elastic.co/t/realtime-search-based-on-2-indexes/240402)
**Author:** [@mexekanez](https://discuss.elastic.co/u/mexekanez)\ **Replies:** 3\ **Last updated:** [August 1, 2020, 11:57am UTC](https://discuss.elastic.co/t/realtime-search-based-on-2-indexes/240402 "2020-08-01T11:57:47Z")
Hello to all! I need some kind of advice, so in general, I have 2 indexes: The first index its aliases ex: my\_name -\> Barak Trump (an amount in first interactions about 50 000 can be much more) Seconds Index it's … --- ## [Can I filter logs with if else condition?](https://discuss.elastic.co/t/can-i-filter-logs-with-if-else-condition/243421)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 10:54am UTC](https://discuss.elastic.co/t/can-i-filter-logs-with-if-else-condition/243421 "2020-08-01T10:54:12Z")
my logs chain is Filebeat =\> Logstash =\> Elasticsearch Now i want to filterize logs with my own field. like match or if else condition key value. So Can I do that or what? need to know how can i do? any blog suggest… --- ## [Elasticsearch change log level](https://discuss.elastic.co/t/elasticsearch-change-log-level/243293)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 7:38am UTC](https://discuss.elastic.co/t/elasticsearch-change-log-level/243293 "2020-07-31T07:38:14Z")
Hi There are lot of configurations in log4j properties. I'm using logstash to insert records to elasticsearch and I need to log those. what is the effect of changing below config? logger.action.name = org.elasticsearc… --- ## [KIBANA : String Length based Filter to my documents](https://discuss.elastic.co/t/kibana-string-length-based-filter-to-my-documents/242927)
**Author:** [@Nivas\_Sundar](https://discuss.elastic.co/u/Nivas_Sundar)\ **Replies:** 6\ **Last updated:** [August 1, 2020, 6:38am UTC](https://discuss.elastic.co/t/kibana-string-length-based-filter-to-my-documents/242927 "2020-08-01T06:38:08Z")
I need to Get the Length of a String datatype value and exclude the documents which have more than 4 characters using Elastic search custom query. I tried below query and didn't work. NO LUCK ! Could anyone help . { "q… --- ## [Elasticsearch nodes are leaving the cluster continuously](https://discuss.elastic.co/t/elasticsearch-nodes-are-leaving-the-cluster-continuously/242853)
**Author:** [@darshan](https://discuss.elastic.co/u/darshan)\ **Replies:** 20\ **Last updated:** [August 1, 2020, 6:29am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-are-leaving-the-cluster-continuously/242853 "2020-08-01T06:29:29Z")
Hi, The nodes in the cluster are leaving continuously and rejoins after few seconds. when I checked for error it says "master not discovered yet: have discovered" error. I don't have any clue what is happening. please c… --- ## [How to auto login in Kibana using apache?](https://discuss.elastic.co/t/how-to-auto-login-in-kibana-using-apache/242596)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 6:20am UTC](https://discuss.elastic.co/t/how-to-auto-login-in-kibana-using-apache/242596 "2020-08-01T06:20:31Z")
I have seen many post about auto login using Nginx. However, how can i auto login to Kibana using apache? I want to user only acess 'sample' space without login. So i configured apache configuration like below: P… --- ## [URL template and embedding iframe](https://discuss.elastic.co/t/url-template-and-embedding-iframe/243376)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 5:57am UTC](https://discuss.elastic.co/t/url-template-and-embedding-iframe/243376 "2020-08-01T05:57:31Z")
Is it possible to leverage url template feature for a index field, and point that to a iframe? and will it take the {{values}} parameter? I could not get it to work. Appreciate if someone can provide insights. --- ## [Where elasticsearch stores policy? and how it picks up?](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622)
**Author:** [@abb](https://discuss.elastic.co/u/abb)\ **Replies:** 17\ **Last updated:** [August 1, 2020, 5:03am UTC](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622 "2020-08-01T05:03:03Z")
I am using Opendistro for ES 1.9.0 , logstash and kibana. I have created few index templates and policies. Now as per this I placed all my templates. It didn't got picked up.. And also where do I need to copy all my… --- ## [Add Sub fields](https://discuss.elastic.co/t/add-sub-fields/243414)
**Author:** [@nurhambali](https://discuss.elastic.co/u/nurhambali)\ **Replies:** 4\ **Last updated:** [August 1, 2020, 4:38am UTC](https://discuss.elastic.co/t/add-sub-fields/243414 "2020-08-01T04:38:30Z")
hi, how to add sub fields on logstash ex: server, time, message i'm add sub field modsec.server modsec.time modsec.message ? any ide ? --- ## [Block in start\_input](https://discuss.elastic.co/t/block-in-start-input/243410)
**Author:** [@Inder](https://discuss.elastic.co/u/Inder)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 1:58am UTC](https://discuss.elastic.co/t/block-in-start-input/243410 "2020-08-01T01:58:07Z")
Hi, This is my conf file: input { file { path =\> "/Users/Parm/cars.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { separator =\> "," columns =\> \[ "maker", "model", "mileage", "… --- ## [How to add filter panel in kibana custom plugin](https://discuss.elastic.co/t/how-to-add-filter-panel-in-kibana-custom-plugin/243080)
**Author:** [@Tejashree\_kate](https://discuss.elastic.co/u/Tejashree_kate)\ **Replies:** 9\ **Last updated:** [August 1, 2020, 12:12am UTC](https://discuss.elastic.co/t/how-to-add-filter-panel-in-kibana-custom-plugin/243080 "2020-08-01T00:12:32Z")
Hi I am trying to develop a custom kibana plugin and want to add the filter bar to my plugin similar to the one in discover How can I add the filter bar to mu custom kibana plugin? --- ## [Discovery and TSVB, doesn't recognize index patterns change](https://discuss.elastic.co/t/discovery-and-tsvb-doesnt-recognize-index-patterns-change/243365)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 6\ **Last updated:** [August 1, 2020, 12:01am UTC](https://discuss.elastic.co/t/discovery-and-tsvb-doesnt-recognize-index-patterns-change/243365 "2020-08-01T00:01:45Z")
I have 4 index patterns with data from diferents sources, in the index pattern section of Kibana I can see the different fields of the indexes, but in discovery and TSVB the fields remain the same when I change the index… --- ## [How to use watcher to detect if logs are missing](https://discuss.elastic.co/t/how-to-use-watcher-to-detect-if-logs-are-missing/243398)
**Author:** [@ElektroKinetik](https://discuss.elastic.co/u/ElektroKinetik)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 11:26pm UTC](https://discuss.elastic.co/t/how-to-use-watcher-to-detect-if-logs-are-missing/243398 "2020-07-31T23:26:11Z")
Hopefully I'm wording this correctly, here is what I'm trying to do, not sure where to start :wink: I have these 4 servers, each with respective log paths and log files, I want to watch server1 /app1/webappA/logs/mywe… --- ## [How to send logs to http output plugins conditionally](https://discuss.elastic.co/t/how-to-send-logs-to-http-output-plugins-conditionally/243403)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 3\ **Last updated:** [July 31, 2020, 10:30pm UTC](https://discuss.elastic.co/t/how-to-send-logs-to-http-output-plugins-conditionally/243403 "2020-07-31T22:30:27Z")
I have one application that I need to monitor which sends the same logs until that error is not resolved. Now, I need to send a notification to Slack when this particular error occurs. Consider these two sample logs: {… --- ## [Ingest Email Bounces](https://discuss.elastic.co/t/ingest-email-bounces/243396)
**Author:** [@xzelkworld](https://discuss.elastic.co/u/xzelkworld)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 10:15pm UTC](https://discuss.elastic.co/t/ingest-email-bounces/243396 "2020-07-31T22:15:44Z")
We have Email bounce. They are in Email Mailbox format, but they are stored on Linux. Currently we have to set up complicate infrastructure to handle such Email Mailbox format ingestion processing. Is there a modern way … --- ## [Computing percentages in transforms](https://discuss.elastic.co/t/computing-percentages-in-transforms/242916)
**Author:** [@cecchet](https://discuss.elastic.co/u/cecchet)\ **Replies:** 5\ **Last updated:** [July 31, 2020, 9:43pm UTC](https://discuss.elastic.co/t/computing-percentages-in-transforms/242916 "2020-07-31T21:43:49Z")
I have a transform that calculates hourly stats of users on each floor of each building: { "id": "building-floor", "source": { "index": \[ "anindex" \], "query": { "match\_all": {} } }, … --- ## [Kibana Stack monitoring page not showing data from metricbeats](https://discuss.elastic.co/t/kibana-stack-monitoring-page-not-showing-data-from-metricbeats/237167)
**Author:** [@souravsahoo](https://discuss.elastic.co/u/souravsahoo)\ **Replies:** 15\ **Last updated:** [July 31, 2020, 9:18pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-page-not-showing-data-from-metricbeats/237167 "2020-07-31T21:18:12Z")
I have been trying to setup a separate monitoring cluster for collecting monitoring data from the production cluster. I have installed metricbeat on each of the production cluster's nodes and metricbeats is successfully … --- ## [Trigger Re-optimization in Kibana](https://discuss.elastic.co/t/trigger-re-optimization-in-kibana/243121)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 9:14pm UTC](https://discuss.elastic.co/t/trigger-re-optimization-in-kibana/243121 "2020-07-31T21:14:24Z")
Using version 6.8.9 Hi, I have been trying to force Kibana to re-optimize, but the only way I have found so far is by deleting the 'optimize' folder under Kibana root folder, and that's not working, but causing Kibana … --- ## [Logstash -\> Elasticsearch index template](https://discuss.elastic.co/t/logstash-elasticsearch-index-template/243339)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 9\ **Last updated:** [July 31, 2020, 8:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-index-template/243339 "2020-07-31T20:52:23Z")
I am running Logstash and a three-node Elasticsearch cluster in docker containers. In the Elasticsearch output plugin of Logstash, I'm attempting to use a custom index template with the following lines in logstash.conf: … --- ## [How to monitor docker swarm status with beats](https://discuss.elastic.co/t/how-to-monitor-docker-swarm-status-with-beats/243394)
**Author:** [@jlvrhee](https://discuss.elastic.co/u/jlvrhee)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 7:59pm UTC](https://discuss.elastic.co/t/how-to-monitor-docker-swarm-status-with-beats/243394 "2020-07-31T19:59:03Z")
Is there a way to monitor the status of docker nodes in a docker swarm? I didn't find any topic about this. We had a problem today that one of your docker nodes was down and we would like to monitor this so we can also d… --- ## [Bootstrap.password not working](https://discuss.elastic.co/t/bootstrap-password-not-working/243374)
**Author:** [@MorgenComm](https://discuss.elastic.co/u/MorgenComm)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 7:39pm UTC](https://discuss.elastic.co/t/bootstrap-password-not-working/243374 "2020-07-31T19:39:03Z")
Hi, I'm trying to setup a new cluster with the official Ansible playbook, which I have done in previous versions 7.7 okay. However I'm trying to create another test cluster on 7.8.1 with security enabled, and the basic … --- ## [Logstash xml input configuration: for multiple documents](https://discuss.elastic.co/t/logstash-xml-input-configuration-for-multiple-documents/243119)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 17\ **Last updated:** [July 31, 2020, 7:35pm UTC](https://discuss.elastic.co/t/logstash-xml-input-configuration-for-multiple-documents/243119 "2020-07-31T19:35:30Z")
Hi Team I'm using http\_poller to poll an end point which gives xml data as response. I'm trying to send this xml data to elasticsearch. But when I run logstash, I see logstash is failing. Please have a look at below co… --- ## [Auditbeat sends unencrypted data](https://discuss.elastic.co/t/auditbeat-sends-unencrypted-data/243366)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 2:56pm UTC](https://discuss.elastic.co/t/auditbeat-sends-unencrypted-data/243366 "2020-07-31T14:56:03Z")
I have two beats on each server. Filebeat and auditbeat. I set up filebeat output to logstash and auditbeat output to elasticsearch. Filebeat encryption works fine. Now I'm setting up auditbeat's encryption. I have copi… --- ## [Not able to run logstash first stash event](https://discuss.elastic.co/t/not-able-to-run-logstash-first-stash-event/243383)
**Author:** [@xzelkworld](https://discuss.elastic.co/u/xzelkworld)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 7:11pm UTC](https://discuss.elastic.co/t/not-able-to-run-logstash-first-stash-event/243383 "2020-07-31T19:11:16Z")
I installed latest logstash 7.8.1 to CentOS 7.8. I am not able to run first stash event: \[root@logstash\]# bin/logstash -e 'input { stdin { } } output { stdout {} }' hello world ^C I don't know why. Please help! Thanks! … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1892) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1894)